Someone telling you "this exchange is solid" doesn't settle whether a platform is legitimate. What settles it is a handful of things you can look up yourself on official pages: where it holds a license, whether it publishes proof of reserves, and whether it wants payment before you can withdraw. The five steps below are in order, each with a link to where you check. If a platform fails within the first two or three, there is no need to go on.
Five checks you can run yourself to see whether an exchange is legit
None of the five needs an account, and none needs you to ask anyone. Take the platform you are considering and start at step 1.
Step 1 · Look for the platform on third-party price trackers
Open CoinGecko's list of exchanges and CoinMarketCap's spot exchange rankings and search for the platform's name. CoinGecko ranks by Trust Score, which by its own description is meant to assess how genuine an exchange's trading volume is; CoinMarketCap shows volume, liquidity, traffic and the number of coins listed. If neither site has it, and the name only turns up in ads or from a "mentor", you can stop here. Being listed only means the platform has been indexed. It doesn't make it legitimate, so keep going.
Step 2 · Find the full name of the company that operates it
In the footer of the platform's site, on its About page or in its terms of service, find the full name of the operating company and where it is registered. You need that exact name to match against a license in the next step. If the site names no operating entity at all, there is no need to go further.
Step 3 · Look the license up in the regulator's public register
Licenses are issued by jurisdiction. Wherever the platform says it is licensed, check that regulator's own register, not the license image the platform displays. Registers you can open directly:
- Hong Kong: the Securities and Futures Commission's lists of virtual asset trading platforms: licensed platforms, applicants (the page stresses that applicants on that list are not licensed), applicants whose applications were returned, refused or withdrawn, and platforms that are closing down. A separate alert list of suspicious virtual asset trading platforms covers unlicensed platforms that have come to the SFC's attention; the SFC notes that it is not a comprehensive list.
- Singapore: the Monetary Authority of Singapore's Financial Institutions Directory, which shows institutions, their licenses and the activities they are permitted to carry out.
- European Union: the European Securities and Markets Authority's MiCA page offers the Interim MiCA Register for download; one of its files is the list of authorized crypto-asset service providers.
The entity name in the register has to match the full company name you found in step 2. If the platform is not in a jurisdiction's register, it has no license there. Rules on crypto trading differ from place to place, and some places don't allow it at all; the rules where you live are the ones that apply.
Step 4 · See whether there is proof of reserves you can verify yourself
Proof of reserves (PoR) is a way for a platform to show publicly that it holds the assets its users have deposited. Find the page on the platform's site and look at two things: is it published on a regular schedule, and can you verify that your own balance was counted? Two examples to compare against (checked October 2026): the OKX proof of reserves page says reports are published monthly, using a Merkle tree and zk-STARKs, and that users can run their own data through its open-source verification tool; the Binance proof of reserves page uses a Merkle tree and zk-SNARKs, and after logging in you can view your own record by date. If there is no such page, or the page gives users no way to verify, count this item as missing.
Step 5 · Read the withdrawal rules before you deposit
Read the withdrawal rules, fees and limits in the help center. You should be able to find them before you deposit anything. Conditions that only appear when you try to withdraw (pay tax first, pay a deposit first, top up to lift a risk-control hold) settle the question the first time one shows up, and nothing else needs checking. The reverse doesn't hold: one successful small withdrawal doesn't prove a platform is reliable, and pig butchering starts by letting you withdraw once.
Signs that rule a platform out at once
When one of these shows up, you can skip the five steps above.
- It promises a fixed daily return, guaranteed principal or profit with no losses. To see what the daily rate it quotes comes to over a year, use the Compound return calculator.
- It pays rewards for recruiting people and building a downline.
- It charges before you can withdraw: tax, a deposit, an unfreezing fee.
- You can only reach it through a link in a direct message or a QR code in a group, and no fixed official domain can be found.
The platform is real: how to make sure you're not on a copy of its site or app
The five steps check the platform itself. Even when the platform passes, the site or app in front of you may be a copy of it. Three more things to match:
- The domain: paste the address you see into the domain checker and compare it with the official domain character by character. A padlock in the address bar (HTTPS) only means the connection is encrypted; it says nothing about whether the site is real.
- The app: go to the official site first, follow its link to the App Store or Google Play, and check the developer name before you install. Don't install a file anyone sends you. What to clean up after installing a fake one is in fake crypto exchange apps.
- People claiming to be from the platform: if a support agent or manager contacts you first, check that phone number or account on the platform's own verification page before anything else. OKX has a Channel verification page, and Binance has Binance Verify, which checks website addresses, emails, phone numbers, Telegram and social media accounts.
Do review screenshots, profit posts in a group or someone's guarantee count as checking?
No. You can't verify review screenshots, profit posts in a group, or the testimony of someone who "has been through it". What counts is what you looked up yourself on the official pages of the regulator and the platform.
After checking the platform
- Beginner crypto safety checklist: account, access and wallet settings to tick off one by one.
- Scam self-check: if someone else brought you to the platform, run through its questions first.